Information Management Assessment

Action plan progress review

Department for Education

Reviewed June 2017

Published September 2017

Working with government to raise standards in information management Contents

Background and action plan development 2 Executive summary 3 Progress to address recommendations and risk areas 4 Next steps 8

© Crown copyright 2017.

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background

- The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

- The Department for Education (DfE) IMA took place in November 2015. The National Archives formally assessed progress to address recommendations in June 2017. This progress review summarises key developments since the IMA.

Action plan development and delivery

- DfE produced a draft action plan in June 2016. A final redacted version was published with the IMA report on The National Archives’ website in January 2017.¹

- The action plan was owned by the central knowledge and information management team and we saw limited evidence that the report’s recommendations had a department-wide impact. Progress to address recommendations was not scrutinised at a senior level and outcomes from the IMA were not reported to the departmental board as recommended by Sir Alex Allan in his 2014 Records Review.²

- Now that the IMA is closed, senior support will be essential if DfE is to address the remaining risks and gaps highlighted in this document and build on and embed the positive progress we recognise.

- Areas where continued attention is still needed are listed below under ‘Next Steps.’

¹ [http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/](http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/)

² [https://www.gov.uk/government/publications/records-review-by-sir-alex-allan](https://www.gov.uk/government/publications/records-review-by-sir-alex-allan) Executive summary

Value of information

- The Future Workplace programme has the potential to help DfE to adopt a more strategic approach to information and records management. While recognising this and the proposed appointment of a Director General sponsor as a potentially good practice approach, we emphasise that DfE should have an endorsed strategy and guiding vision for information and records management.

- This is needed to underpin and provide direction for improvement work including the relevant components of the Future Workplace programme. DfE should also consider identifying a board level champion for information and records in the long term.

- DfE has continued to work to improve its ability to manage risks to its information assets.

Digital information and supporting technology

- DfE has yet to fully define how it will ensure the effective capture, storage and management of information and records to meet legal obligations and business requirements in the new IT environment. To prevent the accumulation of a new digital legacy, consideration should be given to proportionate technical controls and restrictions in addition to cultural improvement work.

- DfE needs to establish concrete plans to ensure that its legacy and current digital information remains usable.

Information risk, governance and oversight

- DfE has still not formally defined the risk centrally of a failure to deliver information and records management outcomes or the impact of a failure to ensure the digital continuity of its information.

- DfE still lacks a means of monitoring information and records management practice. It has no mechanism to routinely surface good practice or to challenge poor practice and encourage improvement.

Records review and transfer

- DfE has improved oversight of its paper records but still has limited understanding of its digital legacy.

- We are pleased to note that DfE is in the process of developing a forward plan for managing the selection and transfer of its paper records for its paper records, factoring in growing volumes to process. It still needs to develop processes for the review, appraisal and transfer of digital information. Progress to address recommendations and risk areas

1 The value of information

| Performance rating | IMA 2015 | Review 2017 | |--------------------|----------|-------------| | Communicating and realising value | Satisfactory | Progressing to Good | | Managing information as an asset | Satisfactory | Satisfactory |

Situation at the time of the IMA

- Staff generally recognised that information had value, but were not necessarily clear how it should be managed. A draft DfE Information Management Strategy had been produced and was being reviewed by Management Committee to ensure it was focussed effectively.

- Policy on information asset registration and ownership had been recently reviewed. A valuation exercise had been conducted to ensure information assets were properly maintained. DfE needed to build on this work to ensure more consistent oversight and control of its information assets.

- DfE has now embedded knowledge, information and records management as one of the three mutually dependent strands of the Future Workplace programme.

- The programme is intended to change and improve ways of working and the use of technology. We noted a positive emphasis on improving culture, removing barriers and engaging and empowering staff. This includes capitalising on modern IT and providing staff with the right tools and simpler, more effective processes in areas such as email management.

- While this represents a significant step forward for DfE, we note that the draft 2015 Information Strategy was not signed off and no successor document has been produced to provide overall focus and direction. Planned meetings with IT to discuss shared strategic priorities have not yet been held.

- At the time of our meeting, DfE indicated that they had strong senior support for the programme and that a formal Director General level sponsor was being sought.

- The DfE information asset register is now hosted on SharePoint. Retention is included among the mandatory fields. DfE recommends that entries are updated at least quarterly. DfE saw an increase in engagement in 2016/17.

- DfE logs a high number of information assets, using its evaluation model to allow the identification by information asset owners of a much smaller core of critical information assets. It has continued to engage with The National Archives’ train- the-trainer programme and is planning to review training provision and enhance awareness through workshops and sharing good practice.

2 Digital information and supporting technology

| Performance rating | IMA 2015 | Review 2017 | |-------------------------------------|-------------------|----------------------| | Supporting information through technology | Development area | Development area | | Digital continuity and IT change | Development area | Development area |

Situation at the time of the IMA

- The department’s on premise SharePoint ERMS, Workplace, was not being utilised in accordance with good practice principles for records systems set out in the Section 46 Code of Practice for Records Management. Disposal was not implemented due to inconsistent application of content types and barriers to collaboration existed. A large volume of information was held in Outlook and in archived personal storage table (.pst) files as well as in shared and personal drives.

- We emphasised the need to look at cultural improvement as well as technical controls and barriers when DfE moved to SharePoint Online.

- DfE was seeking to improve its understanding of its digital information via an e-Discovery exercise. IT and IM staff now needed to work together to ensure a detailed understanding of digital continuity risk factors and plan to address them. DfE needed to ensure IM requirements were routinely factored into the IT procurement process.

- Office 365 has been introduced with SharePoint Online rolled out for live users. The records centre had not yet been migrated at the time of the review meeting.

- Personal drives have been made read only and DfE will be pushing staff to migrate any content that needs to be retained prior to March 2018, after which it plans to dispose of any remaining material.

- While this is positive, we saw no evidence that IT and KIM staff had worked out an overall agreed model for information and records management in the new IT environment. DfE still needs to define how its business requirements will be met extending from capture and lifecycle management though to the selection and transfer of records with historical value.

- DfE has not chosen to impose limits on mailboxes or One Drive to help avoid a recurrence of the issues it encountered in the previous environment. We note that 5TB of information had been accumulated in the first two months after One Drive’s introduction. • We are pleased to note DfE’s intention to focus on the effective use of search and discovery tools in O365. DfE needs however to plan in the long term to ensure that staff both know how to search for information and adhere to good practice in information management. This will help ensure information is readily available across the department and should form a core foundational part of plans to encourage exploitation and use of the information it holds.

• IT and KIM teams are not yet planning collaboratively to enable digital continuity outcomes. DfE has considered using The National Archives’ Digital Records Object Identification (DROID) software tool, but has not yet deployed it. It has yet to set out any formal plans to address digital continuity risks to current and legacy information. It has also not yet addressed its legacy of pst files. The planned Design Authority offers an avenue to a potential avenue to ensure digital continuity as well as information and records management requirements are factored into IT projects.

3 Information risk, governance and oversight

| Performance rating | IMA 2015 | Review 2017 | |--------------------|----------------|----------------------| | Recognising information risk | Satisfactory | Development area | | Establishing control | Development area | Progressing to satisfactory | | Providing guidance | Satisfactory | Satisfactory | | Measuring impact | Development area | Development area |

Situation at the time of the IMA

• We saw evidence of business ownership of information and records management related risk as required by information risk policy. DfE needed to build on the positive start it had made. This included ensuring information and records management related risks were logged centrally at KIM team and information services unit level.

• No senior information governance boards were in place to support formal collaboration between IT, IM and Information Security units on shared and overlapping priorities. Information and records management services were not fully coordinated and service standards had not been defined.

• A comprehensive suite of guidance was in place for information and records management. We recognised that information management was a component in the mandatory training for Content Managers that was also offered to all new users, but emphasised that more needed to be done to promote and mandate required behaviours.

• DfE had not defined a process for monitoring information management maturity and compliance with corporate policy. • No information and records management related risks have been defined and logged at KIM team, departmental, directorate or divisional level.

• DfE still lacks an information focussed governance board or forum to enable discussion of shared priorities and promote decision making. The formation of the Workplace Transformation board, which will have business representation, represents a step forward, but is unlikely to offer a forum for surfacing wider issues out of scope of the programme.

• A significant communications plan was delivered focussing on the move to SharePoint Online and the introduction of the new intranet. At the time of our meeting there were no plans to extend this. Although it is positive that the KIM team plans to work up a training plan, it was unclear at the time of our meeting whether information and records management would be factored into DfE’s induction programme.

• DfE has yet to implement any means of monitoring and reporting on adherence to information and records management policy.

4 Records, review and transfer

| Performance rating | IMA 2015 | Review 2017 | |--------------------|----------|-------------| | Oversight of records and selection | Development area | Development area | | Implementing disposal decisions | Development area | Progressing to Satisfactory |

Situation at the time of the IMA

• DfE needed to improve oversight and control of paper and digital records and awareness of the Departmental Records Officer role at a senior level. We highlighted the potential impact of team changes on the department’s ability to maintain existing standards in appraisal and review, but noted the department’s commitment to engaging with support provided by The National Archives.

• DfE needed to engage with business areas as it worked to define tailored department specific retention and disposal schedules. It was working to develop guidance for sensitivity reviewers and needed to seek legal cover for information inherited from other departments relating to Children’s Homes while it determined how to review them. DfE needed to engage with The National Archives in developing a forward plan to manage the selection and transfer of growing volumes of paper records and for the transfer of digital records. • DfE still needs to promote understanding of the DRO’s role in leading on compliance with the Public Records Act at a senior level.

• The department still lacks oversight of its digital records, but it has taken a key step by engaging with The National Archives to produce a one-year retention application for its digital holdings. This was approved at the July 2017 meeting of the Advisory Council. DfE plans to use e-Discovery software to analyse the contents of its shared drives, and help ensure it can meet the requirements of the Independent Inquiry into Child Sexual Abuse. It has not yet defined a clear plan for this work in practice.

• It also has yet to define an approach for the appraisal, sensitivity review and transfer of digital records and at the time of the review meeting had not produced work plans in line with its retention application.

• However, we are pleased to recognise that DfE does have a better understanding of its paper holdings than at the time of the IMA. It produced a statement on paper holdings in 2017 and is now in the process of drafting an 18-month end-to-end transfer plan. This reflects The National Archives’ gateways and Series Level Time Plan processes and has the potential to provide a good basis for monitoring and controlling transfers once finalised and agreed. It is now supporting efficient and effective selection process through the use of Series Level Appraisal Questionnaires. DfE is aware that the volume of its paper holdings increases significantly from 1995 onwards and is seeking to schedule review work accordingly, with review of records due for transfer in 2018 already underway.

Next Steps

The National Archives will continue to support the Department for Education in its work on information and records management so that it is supported through to the time of its next IMA. In the interim, we recommend that the following points are focussed on and built into departmental business planning:

• Support continued improvement and development of its approach for managing digital information by establishing an agreed strategic vision for information and records management. DfE will need to define how good practice in knowledge, information and records management will be achieved and maintained beyond completion of the Workplace Modernisation programme. There would be benefit in appointing a board-level champion.

• Define a practical model of how information and records management should be delivered in the new IT environment. DfE should consider the use of proportionate technical controls and restrictions as well as cultural and behaviourally focussed work to help shape information and records management practice in Office 365.

• Formally define and log the risk to the department of a failure to manage information and records appropriately and a failure to ensure their availability and usability. • Establish a rolling communications plan to encourage and promote adherence to good practice principles.

• Establish an information focussed governance board to support joined-up working once the Workplace Modernisation programme has completed.

• Set up a mechanism to monitor information management practice, drawing on good practice examples from the IMA programme including those that are in place within HM Treasury and Home Office.

• Continue to engage with The National Archives to systematically map out future arrangements for appraisal, sensitivity review and transfer of paper records, with a view to placing these on a formal agreed footing, ideally through to the end of the transition period for the 20-year rule in 2023.

• Define its approach for the appraisal, selection and transfer of digital records, ensuring that in depth analysis of digital holdings is conducted, including identification of the earliest born-digital records. DfE should seek advice and support from The National Archives in its use of e-Discovery software and deployment of DROID.

• Ensure that IM requirements including digital continuity are considered as a component of the procurement process. DfE should engage with The National Archives to develop a plan to support the ongoing continuity of digital information and management of risks related to its existing digital legacy. This would include putting in place processes to ensure that its digital legacy does not re-accumulate.